Logout Event Type

Contains details of user sessions ending or being revoked.

Logout Event Type is used by EventLogFile (ELF). It isn’t a real-time event. For the LogoutEvent real-time event, which is part of Real-Time Event Monitoring (RTEM), see LogoutEvent in the Platform Events Developer Guide.

Note

These scenarios count as logout events.

  • Logging out via the UI
  • Session expiration
  • Revoking access for a connected app
  • Calling the Salesforce revocation endpoint
  • Salesforce disabling a connected app
  • For batch operations where multiple sessions are revoked at once, Salesforce records only one logout event. You can tell that it’s a batch operation because there’s no user ID.

    Note

For details about event monitoring, see the Trailhead Event Monitoring module or REST API Developer’s Guide.

Fields

Field Details
API_TYPE
Type
String
Description
The type of API request.
Possible values are:
  • D—Apex Class
  • E—SOAP Enterprise
  • M—SOAP Metadata
  • P—SOAP Partner
  • S—SOAP Apex
  • T—SOAP Tooling
  • f—Feed
  • l—Live Agent
  • p—SOAP ClientSync
API_VERSION
Type
String
Description
The version of the API that’s being used.
For example: 36.0.
APP_TYPE
Type
Number
Description
The application type that was in use upon logging out.
Example Values
  • 1000: Application
  • 1007: SFDC Application
  • 1014: Chat
  • 2501: CTI
  • 2514: OAuth
  • 3475: SFDC Partner Portal
BROWSER_TYPE
Type
String
Description
The identifier string returned by the browser used at login.
Example values are:
  • Go-http-client/1.1
  • Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv%3A50.0) Gecko/20100101 Firefox/50.0
  • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36
CLIENT_IP
Type
String
Description
The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from AppExchange) is shown as “Salesforce.com IP”.
For example: 96.43.144.26.
CLIENT_VERSION
Type
Number
Description
The version of the client that was in use upon logging out.
EVENT_TYPE
Type
String
Description
The type of event. The value is always Logout.
LOGIN_KEY
Type
String
Description
The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring.
For example: GeJCsym5eyvtEK2I.
ORGANIZATION_ID
Type
Id
Description
The 15-character ID of the organization.
For example: 00D000000000123.
PLATFORM_TYPE
Type
Number
Description
The code for the client platform. If a timeout caused the logout, this field is null.
Example Values
  • 1000: Windows
  • 1008: Windows 2003
  • 1013: Windows 8.1
  • 1015: Windows 10
  • 2003: Macintosh/Apple OSX
  • 4000: Linux
  • 5005: Android
  • 5006: iPhone
  • 5007: iPad
  • 5200: Android 10.0
REQUEST_ID
Type
String
Description
The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID.
For example: 3nWgxWbDKWWDIk0FKfF5DV.
RESOLUTION_TYPE
Type
Number
Description
The screen resolution of the client. If a timeout caused the logout, this field is null.
SESSION_KEY
Type
String
Description
The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started.
For example: d7DEq/ANa7nNZZVD.
SESSION_LEVEL
Type
String
Description
The security level of the session that was used when logging out.
Possible Values
  • 1: Standard Session
  • 10: High-Assurance Session
SESSION_TYPE
Type
String
Description
The session type that was used when logging out.
Possible Values
  • A: API
  • I: APIOnlyUser
  • N: ChatterNetworks
  • Z: ChatterNetworksAPIOnly
  • C: Content
  • P: OauthApprovalUI
  • O: Oauth2
  • T: SiteStudio
  • R: SitePreview
  • S: SubstituteUser
  • B: TempContentExchange
  • G: TempOauthAccessTokenFrontdoor
  • Y: TempVisualforceExchange
  • F: TempUIFrontdoor
  • U: UI
  • E: UserSite
  • V: Visualforce
  • W: WDC_API
TIMESTAMP
Type
String
Description
The access time of Salesforce services in GMT.
For example: 20130715233322.670.

When a customer logs out by using the Logout button, the TIMESTAMP field records the actual logout time. However, when a customer is logged out automatically, Salesforce detects the event by using a process that runs every 15 minutes. TIMESTAMP values can reflect a logout time up to 15 minutes later than the actual automatic logout time.

TIMESTAMP_DERIVED
Type
DateTime
Description
The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ).
For example: 2015-07-27T11:32:59.555Z. Timezone is GMT.
USER_ID
Type
Id
Description
The 15-character ID of the user who’s using Salesforce services through the UI or the API.
For example: 00530000009M943
USER_ID_DERIVED
Type
Id
Description
The 18-character case insensitive ID of the user who’s using Salesforce services through the UI or the API.
For example: 00590000000I1SNIA0.
USER_INITIATED_LOGOUT
Type
Boolean
Description
The value is 1 if the user intentionally logged out of the organization by clicking the Logout button. If the user’s session timed out due to inactivity or another implicit logout action, the value is 0.
USER_TYPE
Type
String
Description
The category of user license of the user that logged out.
Possible Values
  • A: Automated Process
  • b: High Volume Portal
  • C: Customer Portal User
  • D: External Who
  • F: Self-Service
  • G: Guest
  • L: Package License Manager
  • N: Salesforce to Salesforce
  • n: CSN Only
  • O: Power Custom
  • o: Custom
  • P: Partner
  • p: Customer Portal Manager
  • S: Standard
  • X: Salesforce Administrator